Full Disclosure mailing list archives
Re: Two MSIE 6.0/7.0 NULL pointer crashes
From: Jeffrey Walton <noloader () gmail com>
Date: Fri, 22 Jan 2010 04:42:56 -0500
Given Microsoft's already poor reputation regarding security, I'm not sure how it'd be possible for them to degrade their reputation any more
I don't believe its as bad as you think since Microsoft adopted a SDLC (prior to circa 2001 was a different story). I also believe a significant portion of the perception is due to vendors running on a Windows operating system. When is the last time you heard someone bashing Adobe, which is currently 'King of the Vulnerability Hill.'? "Adobe surpasses Microsoft as favorite hacker’s target" (Jul 2009) http://lastwatchdog.com/adobe-surpasses-microsoft-favorite-hackers-target/ "Adobe predicted as top 2010 hacker target" (Dec 2009) http://www.theregister.co.uk/2009/12/29/security_predictions_2010/. You're probably not going to like this, but in 2003, Apache on Linux over took IIS as most defaced (the Server market share between Windows and *nix appears to be about equal - see below). Zone-H Statistics Report, http://www.zone-h.org/news/id/4686 I'm not sticking up for Microsoft. I simply claim the numbers state otherwise.
Very few people use Microsoft software because of its security reputation.
Presuming 'people' equates to Desktop installations, the numbers I have seen indicate otherwise. When estimated through browser use, Microsoft appears to have about 90%. Personally, I am familiar with two US federal agencies where the desktop is exclusively Microsoft (about 160,000 total hosts combined, unless the US government has downsized since 2006). If you're talking about servers, the numbers indicate that Microsoft is on par with *nix (IDC report) or slightly above *nix (Gartner report). Again, I'm not sticking up for Microsoft. I simply claim the numbers state otherwise.
The main reasons for using Microsoft are ease of use and compatibility with other users.
Is *nix not trying to do the same? These are two key factors which *must* be fulfilled before *nix can displace Microsoft on the Desktop. IT departments like 'easy to use' - it keeps help desk calls to a minimum. IT departments also like compatibility since they don't have to spend time researching problems, workarounds, and solutions.
Given that, I'm not sure that Microsoft's perception will be affected very much in the user community.
Agreed. I do question Microsoft's position on *not* patching flaws when discovered or reported in a timely manner. But that's another story, and brings in co-conspirators, such as iDefense and TippingPoint. For example, CVE-2009-2502 was reported to Microsoft in 2007 by a firm which buys bugs to save everyone from 0-days. Microsoft probably knew about the 2502 bug earlier, since the GDI+/JPEG vuln was made public in Microsoft Security Bulletin MS04-028 (I'm making the leap that Microsoft performed additional audits on the GDI+ module when reports started arriving). Yet the bug was not fixed until 2009 (almost 2 years). See http://seclists.org/fulldisclosure/2009/Oct/196. ~JW On Thu, Jan 21, 2010 at 6:34 PM, Rohit Patnaik <quanticle () gmail com> wrote:
Given Microsoft's already poor reputation regarding security, I'm not sure how it'd be possible for them to degrade their reputation any more. Very few people use Microsoft software because of its security reputation. The main reasons for using Microsoft are ease of use and compatibility with other users. Given that, I'm not sure that Microsoft's perception will be affected very much in the user community. -- Rohit Patnaik On Wed, Jan 20, 2010 at 6:17 PM, ☣ frank^2 <frank2 () dc949 org> wrote:On Wed, Jan 20, 2010 at 10:25 AM, Dan Kaminsky <dan () doxpara com> wrote:Seriously. I mean, just look at Linux, Firefox, and OpenOffice. Pristine code, not a single security vulnerability between them :)That's a red herring. His point was the public perception of the software company-- true or not-- would be hindered because Microsoft is all-encompassing. Compared to the world of open-source, the risk is distributed by the sheer virtue of software engineering being distributed amongst thousands of entities. This means that the vulnerabilities are spread across different parties, rather than having all vulnerabilities encompassed by a single party-- in this case, Microsoft. His argument was irrelevant to corporations vs. open-source being more vulnerable than one another-- it was simply a commentary on distributed risk in software engineering. -- "Did you and them get your degree from the same university of trolls? I have mistaken nothing for nothing. Fuck you." _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Two MSIE 6.0/7.0 NULL pointer crashes, (continued)
- Re: Two MSIE 6.0/7.0 NULL pointer crashes James Matthews (Jan 20)
- Re: Two MSIE 6.0/7.0 NULL pointer crashes omg wtf (Jan 20)
- Re: Two MSIE 6.0/7.0 NULL pointer crashes Valdis . Kletnieks (Jan 20)
- Re: Two MSIE 6.0/7.0 NULL pointer crashes T Biehn (Jan 20)
- Re: Two MSIE 6.0/7.0 NULL pointer crashes Dan Kaminsky (Jan 20)
- Re: Two MSIE 6.0/7.0 NULL pointer crashes Christian Sciberras (Jan 20)
- Re: Two MSIE 6.0/7.0 NULL pointer crashes Michael Holstein (Jan 20)
- Re: Two MSIE 6.0/7.0 NULL pointer crashes Chris Evans (Jan 20)
- Re: Two MSIE 6.0/7.0 NULL pointer crashes ☣ frank^2 (Jan 20)
- Re: Two MSIE 6.0/7.0 NULL pointer crashes Rohit Patnaik (Jan 21)
- Re: Two MSIE 6.0/7.0 NULL pointer crashes Jeffrey Walton (Jan 22)
- Re: Two MSIE 6.0/7.0 NULL pointer crashes Valdis . Kletnieks (Jan 23)
- Re: Two MSIE 6.0/7.0 NULL pointer crashes Christian Sciberras (Jan 23)
- Re: Two MSIE 6.0/7.0 NULL pointer crashes James Matthews (Jan 20)
- Re: Two MSIE 6.0/7.0 NULL pointer crashes dramacrat (Jan 20)
- Re: Two MSIE 6.0/7.0 NULL pointer crashes Jeffrey Walton (Jan 20)
- Re: Two MSIE 6.0/7.0 NULL pointer crashes Dan Kaminsky (Jan 20)
- Re: Two MSIE 6.0/7.0 NULL pointer crashes Michal Zalewski (Jan 20)
- Re: Two MSIE 6.0/7.0 NULL pointer crashes mrx (Jan 21)
- Re: Two MSIE 6.0/7.0 NULL pointer crashes Dan Kaminsky (Jan 21)
- Re: Two MSIE 6.0/7.0 NULL pointer crashes Christian Sciberras (Jan 21)